mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-10-27 08:19:07 +00:00
Kevin Veen-Birkenbach
ab48cf522f
- prevent task failure when 'User exists with same username' - remove invalid '--temporary false' flag from set-password command - ensure realm-admin role grant remains idempotent See: https://chatgpt.com/share/68e99271-fdb0-800f-a8ad-11c15d02a670
79 lines
2.9 KiB
YAML
79 lines
2.9 KiB
YAML
- name: Ensure permanent Keycloak admin exists and can log in (container env only)
|
|
block:
|
|
|
|
- name: Try login with permanent admin (uses container ENV)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
{{ KEYCLOAK_KCADM }} config credentials \
|
|
--server {{ KEYCLOAK_SERVER_INTERNAL_URL }} \
|
|
--realm master \
|
|
--user "$KEYCLOAK_PERMANENT_ADMIN_USERNAME" \
|
|
--password "$KEYCLOAK_PERMANENT_ADMIN_PASSWORD"
|
|
'
|
|
register: kc_login_perm
|
|
changed_when: false
|
|
|
|
rescue:
|
|
|
|
- name: Login with bootstrap admin (uses container ENV)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
{{ KEYCLOAK_KCADM }} config credentials \
|
|
--server {{ KEYCLOAK_SERVER_INTERNAL_URL }} \
|
|
--realm master \
|
|
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
|
|
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD"
|
|
'
|
|
register: kc_login_bootstrap
|
|
changed_when: false
|
|
|
|
- name: Ensure permanent admin user exists (create if missing)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
# Try to create; if it already exists, Keycloak returns 409
|
|
{{ KEYCLOAK_KCADM }} create users -r master \
|
|
-s "username=$KEYCLOAK_PERMANENT_ADMIN_USERNAME" \
|
|
-s "enabled=true"
|
|
'
|
|
register: kc_create_perm_admin
|
|
failed_when: >
|
|
not (
|
|
kc_create_perm_admin.rc == 0 or
|
|
(kc_create_perm_admin.stderr is defined and
|
|
('User exists with same username' in kc_create_perm_admin.stderr))
|
|
)
|
|
changed_when: kc_create_perm_admin.rc == 0
|
|
|
|
- name: Set permanent admin password (by username, no ID needed)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
{{ KEYCLOAK_KCADM }} set-password -r master \
|
|
--username "$KEYCLOAK_PERMANENT_ADMIN_USERNAME" \
|
|
--new-password "$KEYCLOAK_PERMANENT_ADMIN_PASSWORD"
|
|
'
|
|
changed_when: true
|
|
|
|
- name: Grant realm-admin role to permanent admin (by username)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
{{ KEYCLOAK_KCADM }} add-roles -r master \
|
|
--uusername "$KEYCLOAK_PERMANENT_ADMIN_USERNAME" \
|
|
--cclientid realm-management \
|
|
--rolename realm-admin
|
|
'
|
|
register: kc_grant_admin
|
|
changed_when: (kc_grant_admin.stderr is defined and kc_grant_admin.stderr | length > 0) or
|
|
(kc_grant_admin.stdout is defined and kc_grant_admin.stdout | length > 0)
|
|
failed_when: false
|
|
|
|
- name: Verify login with permanent admin (after creation)
|
|
shell: |
|
|
{{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
|
|
{{ KEYCLOAK_KCADM }} config credentials \
|
|
--server {{ KEYCLOAK_SERVER_INTERNAL_URL }} \
|
|
--realm master \
|
|
--user "$KEYCLOAK_PERMANENT_ADMIN_USERNAME" \
|
|
--password "$KEYCLOAK_PERMANENT_ADMIN_PASSWORD"
|
|
'
|
|
changed_when: false
|